CVE-2026-102814High· 8.7▾ TwilightAn authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible.
Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
re305_v3 < 1.1.8 Build 20260921 Rel. 42853Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102815Medium· 6.9Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
CVE-2026-102812Medium· 6.9Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
CVE-2026-102816Medium· 5.3Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
CVE-2026-102813Medium· 6.1Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
CVE-2026-18330Medium· 6.1A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4
CVE-2026-84682High· 7.7A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1